All Detections

Potential Mpclient.DLL Sideloading

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202504

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

Sigma